Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 23:41
General
-
Target
c5401eb078571bf9e68935912fcf829bfa7d958344496d5d81b0f0efd449f60e.dll
-
Size
531KB
-
MD5
6c7f96f3793674521ab35c30b6d3cc18
-
SHA1
9bab5239a7e494b5f3cb4b46453d83990759a329
-
SHA256
c5401eb078571bf9e68935912fcf829bfa7d958344496d5d81b0f0efd449f60e
-
SHA512
b31f5875ed4b75d43c269617ae87d1f942ee5df2a14f1f575ec473d9ef775b7a3ecc4f5815872056fe65a3bf3db5679628fb34cfe5653fcc25d0557e3daf0763
-
SSDEEP
12288:zI3OyyTrBVuhjecqtEKmtcrcAFcqXm44FBr:zLluhantEK3cAyqXm44FBr
Malware Config
Extracted
emotet
Epoch5
78.47.204.80:443
62.171.178.147:8080
165.232.185.110:8080
103.41.204.169:8080
54.37.228.122:443
202.29.239.162:443
103.71.99.57:8080
64.227.55.231:8080
85.214.67.203:8080
139.196.72.155:8080
195.77.239.39:8080
202.28.34.99:8080
54.37.106.167:8080
103.126.216.86:443
68.183.91.111:8080
104.244.79.94:443
85.25.120.45:8080
116.124.128.206:8080
210.57.209.142:8080
103.85.95.4:8080
Signatures
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet family
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\c5401eb078571bf9e68935912fcf829bfa7d958344496d5d81b0f0efd449f60e.dll1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\NohiU\DpwcKxH.dll"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
492KB
-
Filesize
492KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
492KB